IDE Agent Kit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:08 PM UTC
• Version: 0.4.1

Overview

The skill is transparent about its multi-agent coordination features, but it asks users to install an unpinned global npm package that enables networking, scheduling, credentials, and command execution outside the reviewed artifact.

Review the npm package and source before installing, prefer a pinned version in an isolated project environment, and only configure tokens, webhooks, cron jobs, or command allowlists for repositories where cross-agent automation is intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14 and 56–59
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: ide-agent-kit
    bins: [ide-agent-kit]

bash

npm install -g ide-agent-kit
ide-agent-kit init --ide claude-code

Technical Analysis

The skill directs users to install ide-agent-kit from the npm registry without specifying an exact version or integrity digest. It also recommends a global installation, making the resulting executable available throughout the user's environment.

The reviewed project contains only SKILL.md; it does not contain the package implementation, a lockfile, vendored source, or cryptographic integrity metadata. Consequently, the dependency's implementation and the document's security claims—including the absence of lifecycle scripts, localhost-only binding, credential handling, and command allowlisting—cannot be independently verified from the audited artifact.

Because npm package resolution is mutable, the code installed later may differ from the code that existed when this skill was reviewed. A malicious release, compromised maintainer account, or registry/package takeover could therefore introduce unsafe behavior without requiring any change to SKILL.md.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious release under the existing ide-agent-kit package name.
3. A user follows the skill's instructions and runs npm install -g ide-agent-kit.
4. npm resolves the current mutable release because no exact version or integrity digest is specified.
5. The malicious package is installed with the privileges of the invoking user and exposes a global executable.
6. When installation behavior or the executable is invoked, malicious code can access resources available to that user.

Impa

...[truncated 627 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than resolving the latest registry release.
2. Record and verify a cryptographic integrity digest for the distributed package.
3. Include a lockfile and use deterministic installation procedures such as npm ci where applicable.
4. Avoid global installation; install the executable in an isolated, least-privileged project environment.
5. Vendor or bundle the reviewed implementation so the executed code is identical to the audited code.
6. Include the dependency source in future audit artifacts so its network, filesystem, credential, command-execution, webhook, and scheduling behavior can be validated.
7. Inspect the package archive and lifecycle configuration before installation, and enforce installation policies that disable lifecycle scripts unless explicitly required and audited.
8. Monitor the package publisher and release provenance, and require trusted signatures or equivalent supply-chain attestations before upgrades.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

**Advanced (requires explicit opt-in and credentials):**
- `sessions`, `gateway` — talk to an OpenClaw gateway (requires `openclaw.token` in config)
- `poll` — connects to Ant Farm rooms (requires `--api-key` flag)
- `emit`, `hooks create` — POST data to external URLs you specify
- `tmux run`, `exec` — execute shell commands (restricted to an allowlist in config)

No advanced features activate without explicit configuration. The default `init` config has empty credential fields and a minimal command allowlist.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

| Command | Requires | Description |
|---------|----------|-------------|
| `sessions send --agent <id> --message <text>` | `openclaw.token` | Send message to agent via gateway |
| `sessions spawn --task <text>` | `openclaw.token` | Spawn a new agent session |
| `sessions list\|history\|status` | `openclaw.token` | Query sessions |
| `gateway trigger\|health\|agents` | `openclaw.token` | Gateway operations |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

**Advanced (requires explicit opt-in and credentials):**
- `sessions`, `gateway` — talk to an OpenClaw gateway (requires `openclaw.token` in config)
- `poll` — connects to Ant Farm rooms (requires `--api-key` flag)
- `emit`, `hooks create` — POST data to external URLs you specify
- `tmux run`, `exec` — execute shell commands (restricted to an allowlist in config)

No advanced features activate without explicit configuration. The default `init` config has empty credential fields and a minimal command allowlist.

Static analysis

No suspicious patterns detected.